RavenForge OT - remote access checklist

1. Can each supplier session be attributed to a named person?
2. Is access approved, bounded and set to expire?
3. Is strong authentication enforced or an exception reviewed?
4. Is the access path approved and restricted?
5. Are supplier endpoint expectations agreed?
6. Can access activity be reviewed?
7. Is emergency access controlled and reviewed?
8. Are subcontractors and onward access known?

For each: record an owner, evidence reference, gap and next action. This is an original discussion aid, not certification.